SQLAlchemy's text() Function Opens SQL Injection Risk in AI-Generated Code

SQLAlchemy's ORM normally prevents SQL injection by using parameterized queries, where values are passed separately from SQL strings. However, the text() function bypasses this protection when developers use f-strings or % formatting to build raw SQL queries. Security firm BrassCoders found that AI coding assistants frequently generate this vulnerable pattern because raw SQL is shorter and satisfies the prompt faster than chained ORM calls. SQLAlchemy's own documentation warns against string-formatting user-supplied values with text() and recommends bindparams() as the safe alternative. Automated static analysis tools flagging text() misuse at the commit level are highlighted as a necessary safeguard, since AI models do not evaluate security unless explicitly prompted to do so.